{"id":2150,"date":"2026-06-03T08:00:00","date_gmt":"2026-06-03T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2150"},"modified":"2026-10-21T14:13:23","modified_gmt":"2026-10-21T13:13:23","slug":"informacoes-relacionadas-com-a-intercecao-iri-vs-cc","status":"publish","type":"post","link":"https:\/\/ic-services.io\/pt\/resources\/blog\/iri-vs-cc-intercept-related-information\/","title":{"rendered":"IRI vs CC: o que significa na pr\u00e1tica a informa\u00e7\u00e3o relacionada com a interce\u00e7\u00e3o"},"content":{"rendered":"

Intercept related information forms the metadata backbone of every interce\u00e7\u00e3o legal<\/a> operation. In lawful interception, two categories of data are fundamental to every interception operation: intercept-related information (IRI) and content of communication (CC). These two data types form the core of what an operator delivers to law enforcement when executing an interception order, and they are carried over separate handover interfaces \u2014 HI2 for IRI and HI3 for CC \u2014 in the ETSI framework. While most practitioners understand the basic distinction \u2014 IRI is metadata, CC is content \u2014 the practical implications of this distinction are more nuanced than they first appear.<\/p>\n\n\n\n

Este artigo analisa o significado pr\u00e1tico de IRI e CC, os elementos de dados que cada um engloba, a forma como s\u00e3o gerados e entregues e a raz\u00e3o pela qual a distin\u00e7\u00e3o \u00e9 importante para os operadores, para as autoridades respons\u00e1veis pela aplica\u00e7\u00e3o da lei e para o ecossistema mais vasto da interce\u00e7\u00e3o legal.<\/p>\n\n\n\n

O que significam as informa\u00e7\u00f5es relacionadas com a interce\u00e7\u00e3o<\/h2>\n\n\n\n

Intercept-related information encompasses all the metadata associated with an intercepted communication. In the simplest terms, IRI answers the questions: who communicated, with whom, when, for how long, using what service, and from where? It does not include the substance of the communication itself \u2014 that is the domain of CC. IRI is defined by the applicable handover standard: the ETSI TS 102 232 series for IP-based services, ETSI TS 101 671 \/ 3GPP TS 33.108 for legacy mobile and circuit-switched services, and 3GPP TS 33.128 for 4G\/5G under the current 3GPP architecture. These specify the data elements, encoding formats, and delivery mechanisms for different network technologies.<\/p>\n\n\n\n

Os elementos de dados espec\u00edficos inclu\u00eddos no IRI variam consoante o tipo de comunica\u00e7\u00e3o e a tecnologia de rede envolvida. Para uma chamada de voz tradicional, o IRI inclui normalmente o n\u00famero chamador (n\u00famero A), o n\u00famero chamado (n\u00famero B), o IMSI e o IMEI do dispositivo do destinat\u00e1rio, a hora a que a chamada foi iniciada, a hora a que foi atendida, a dura\u00e7\u00e3o da chamada, os identificadores de c\u00e9lula no in\u00edcio e durante a chamada (fornecendo informa\u00e7\u00f5es de localiza\u00e7\u00e3o) e a disposi\u00e7\u00e3o da chamada (atendida, ocupada, sem resposta, reencaminhada). Para uma sess\u00e3o de dados IP, o IRI pode incluir o endere\u00e7o IP do alvo, o APN (Access Point Name) atribu\u00eddo, os par\u00e2metros do portador, as horas de in\u00edcio e fim da sess\u00e3o e o volume de dados transferidos.<\/p>\n\n\n\n

IRI is generated as a series of events that correspond to the progression of the communication. The ETSI standards define specific IRI event types for different stages of a communication \u2014 for example, a call setup event, an answer event, a call release event, and various supplementary service events. Each event carries the relevant data elements and an accurate timestamp. Interception points in the network elements detect these events in the signalling (SIP, Diameter, GTP, SS7 and others) and pass them to the fun\u00e7\u00e3o de media\u00e7\u00e3o<\/a>, which turns them into standard IRI records in ETSI format.<\/p>\n\n\n\n

Uma das carater\u00edsticas mais importantes das IRI \u00e9 o seu car\u00e1cter estruturado. Como as IRI s\u00e3o codificadas no formato ASN.1 de acordo com estruturas de dados bem definidas, podem ser automaticamente analisadas, processadas e analisadas pelos sistemas de aplica\u00e7\u00e3o da lei. Este formato estruturado permite opera\u00e7\u00f5es automatizadas de correla\u00e7\u00e3o, an\u00e1lise de padr\u00f5es e extra\u00e7\u00e3o de dados que seriam muito mais dif\u00edceis com dados n\u00e3o estruturados. O valor investigativo das IRI n\u00e3o deve ser subestimado - em muitos casos, os metadados fornecidos pelas IRI s\u00e3o t\u00e3o ou mais valiosos do que o pr\u00f3prio conte\u00fado.<\/p>\n\n\n\n

Defini\u00e7\u00e3o de CC: A camada de conte\u00fado<\/h2>\n\n\n\n

Content of communication is the actual substance of the intercepted communication \u2014 the words spoken in a phone call, the web pages browsed during a data session, the files attached to an email. CC represents what was communicated, as opposed to the contextual information about the communication. CC is delivered over the HI3 interface to the LEMF.<\/p>\n\n\n\n

The format of CC varies dramatically depending on the type of communication. For voice calls, CC is a real-time audio stream, typically encoded using codecs such as AMR (Adaptive Multi-Rate), AMR-WB (Wideband), or G.711. The audio must be delivered in real time so that law enforcement can monitor the conversation as it occurs, though it is also typically recorded for later review. SMS is a notable exception: in 3GPP networks the message text travels with the IRI over HI2, not as CC over HI3, and whether the full text may be delivered depends on the scope of the warrant. For data sessions, CC consists of the IP packets exchanged by the target, which may contain web browsing traffic, email content, application data, streaming media, and any other type of IP-based communication.<\/p>\n\n\n\n

A interce\u00e7\u00e3o de dados produz um volume de CC significativamente maior do que a interce\u00e7\u00e3o de voz. Uma \u00fanica chamada de voz gera um fluxo de \u00e1udio cont\u00ednuo, mas com uma largura de banda relativamente baixa, enquanto uma sess\u00e3o de dados pode gerar gigabytes de tr\u00e1fego, dependendo da atividade do alvo. Esta disparidade tem implica\u00e7\u00f5es importantes para o dimensionamento dos sistemas de LI, para a largura de banda dos canais de transmiss\u00e3o HI3 e para a capacidade de armazenamento necess\u00e1ria na LEMF.<\/p>\n\n\n\n

The delivery of CC must be timely. For voice interception, this means real-time delivery with minimal latency. For data interception, near-real-time delivery is typically required, though the exact requirements may vary by jurisdiction. For IP-based handover, ETSI TS 102 232-1 delivers CC over TCP, protected by a VPN or TLS; legacy circuit-switched handover uses ISDN bearer channels.<\/p>\n\n\n\n

Porque \u00e9 que a distin\u00e7\u00e3o \u00e9 importante<\/h2>\n\n\n\n

The distinction between IRI and CC is not merely technical \u2014 it has significant legal, operational, and strategic implications. From a legal perspective, many jurisdictions treat metadata and content differently. Some interception orders may authorise the collection of both IRI and CC, while others may be limited to metadata only. The legal thresholds for obtaining authorisation may differ, with content interception typically requiring a higher standard of evidence or a more serious category of offence. Operators must be able to activate IRI-only, CC-only and combined IRI-plus-CC intercepts independently, as the scope of the interception order dictates what data can be collected and delivered.<\/p>\n\n\n\n

De um ponto de vista operacional, o IRI e o CC t\u00eam carater\u00edsticas diferentes em termos de volume, formato, requisitos de processamento e mecanismos de entrega. O IRI \u00e9 relativamente compacto e estruturado, o que o torna adequado para o processamento e an\u00e1lise automatizados. O CC \u00e9 potencialmente volumoso e varia muito em termos de formato, exigindo diferentes abordagens de tratamento, armazenamento e an\u00e1lise. Os operadores devem conceber os seus sistemas de LI para tratar ambos os tipos de dados de forma eficiente, com mecanismos adequados de buffering, controlo de fluxo e qualidade de servi\u00e7o.<\/p>\n\n\n\n

From a strategic and investigative perspective, IRI and CC provide different types of intelligence. IRI enables pattern analysis, network mapping, location tracking, and the identification of communication patterns over time. CC provides direct insight into the substance of specific communications but may require significant effort to process and analyse \u2014 particularly for data interceptions that produce large volumes of mixed-media content. Autoridades respons\u00e1veis pela aplica\u00e7\u00e3o da lei<\/a> increasingly recognise the strategic value of metadata, and in some investigations, IRI may be the primary focus of the interception effort.<\/p>\n\n\n\n

IRI em redes modernas<\/h2>\n\n\n\n

A transi\u00e7\u00e3o das redes comutadas por circuitos para as redes comutadas por pacotes alargou significativamente o \u00e2mbito e a complexidade da IRI. Nas redes de telefonia tradicionais, a IRI era relativamente simples - a sinaliza\u00e7\u00e3o da configura\u00e7\u00e3o da chamada fornecia um conjunto bem definido de elementos de metadados. Nas redes IP modernas, o panorama da sinaliza\u00e7\u00e3o \u00e9 muito mais diversificado e complexo, envolvendo protocolos como o SIP, Diameter, GTP-C e v\u00e1rios protocolos da camada de aplica\u00e7\u00e3o.<\/p>\n\n\n\n

VoLTE, for example, uses SIP signalling over the IMS (IP Multimedia Subsystem) core, combined with Diameter for authentication and policy control and GTP for bearer management. Generating complete IRI for a VoLTE call requires interception points in several IMS and packet-core functions, whose events the mediation function must correlate into one coherent picture of the call. The ETSI standards define specific IRI data elements for IMS-based services, but the practical implementation can be challenging.<\/p>\n\n\n\n

In 5G networks, the complexity increases further. The service-based architecture of the 5G core introduces new network functions and signalling interfaces that must be monitored for IRI generation. The 3GPP LI architecture for 5G defines specific point-of-interception (POI) locations and IRI data elements for 5G services, but operators must ensure that each 5G network function’s built-in point of interception is enabled and delivers the 3GPP-defined X2 records (TS 33.128), and that their mediation and delivery function supports them.<\/p>\n\n\n\n

O impacto da encripta\u00e7\u00e3o na CC<\/h2>\n\n\n\n

Um dos desafios mais significativos para a entrega de CC nas redes modernas \u00e9 a crescente preval\u00eancia da encripta\u00e7\u00e3o. As comunica\u00e7\u00f5es encriptadas de ponta a ponta - como as fornecidas por aplica\u00e7\u00f5es de mensagens com E2EE - n\u00e3o podem ser interceptadas na camada de rede de forma significativa. O operador pode capturar os pacotes encriptados, mas sem as chaves de encripta\u00e7\u00e3o, o conte\u00fado \u00e9 inintelig\u00edvel. Isto cria uma situa\u00e7\u00e3o em que o operador pode fornecer IRI (que \u00e9 gerado a partir da sinaliza\u00e7\u00e3o da rede e n\u00e3o depende do acesso ao conte\u00fado), mas n\u00e3o pode fornecer CC utiliz\u00e1vel.<\/p>\n\n\n\n

This encryption challenge has become one of the central policy debates in the lawful interception community. Law enforcement agencies argue that encryption creates blind spots that hinder criminal investigations, while privacy advocates maintain that strong encryption is essential for protecting fundamental rights. The resolution of this debate \u2014 if one is reached \u2014 will have profound implications for the CC component of lawful interception. In the meantime, operators must remove any encryption they provide or manage, or hand over the keys. End-to-end encryption that an over-the-top application controls is outside their reach, so they deliver that content as they see it, while being transparent with law enforcement about the limitations imposed by encryption.<\/p>\n\n\n\n

Considera\u00e7\u00f5es pr\u00e1ticas para os operadores<\/h2>\n\n\n\n

Operators implementing LI systems must ensure that their points of interception and their mediation function together produce complete, accurate, and timely IRI and CC for all services and network technologies in their portfolio. This requires every relevant network function to support standard X2\/X3 delivery (ETSI TS 103 221-2, 3GPP TS 33.128), and careful attention to correlation and timing in the mediation function.<\/p>\n\n\n\n

Os testes s\u00e3o essenciais para verificar se o IRI e o CC s\u00e3o gerados corretamente. Os operadores devem efetuar testes exaustivos em rela\u00e7\u00e3o \u00e0s defini\u00e7\u00f5es da estrutura de dados ETSI IRI, assegurando que todos os elementos de dados necess\u00e1rios est\u00e3o presentes e corretamente preenchidos para cada tipo de evento. A entrega de CC deve ser testada quanto \u00e0 fidelidade, ao tempo e \u00e0 exaustividade em todos os tipos de suportes suportados.<\/p>\n\n\n\n

Por \u00faltimo, os operadores devem manter os seus sistemas de LI \u00e0 medida que as suas redes evoluem. Novos servi\u00e7os, novos protocolos e novas tecnologias de rede exigir\u00e3o actualiza\u00e7\u00f5es das capacidades de gera\u00e7\u00e3o de IRI e de captura de CC. Um sistema de interce\u00e7\u00e3o legal que estava totalmente em conformidade no momento da implanta\u00e7\u00e3o pode tornar-se n\u00e3o conforme \u00e0 medida que a rede muda, tornando a manuten\u00e7\u00e3o e o desenvolvimento cont\u00ednuos uma parte essencial do programa de conformidade.<\/p>\n\n\n\n

Conclus\u00e3o<\/h2>\n\n\n\n

O IRI e o CC s\u00e3o os dois pilares do fornecimento de dados de interce\u00e7\u00e3o legal. O IRI fornece os metadados estruturados que permitem a an\u00e1lise de padr\u00f5es, a localiza\u00e7\u00e3o e o mapeamento de comunica\u00e7\u00f5es. O CC fornece o conte\u00fado real das comunica\u00e7\u00f5es interceptadas, oferecendo uma vis\u00e3o direta do que os alvos est\u00e3o a comunicar. Em conjunto, formam um quadro completo que apoia as investiga\u00e7\u00f5es policiais. Para os operadores, compreender as implica\u00e7\u00f5es t\u00e9cnicas, legais e operacionais da IRI e da CC - e criar sistemas de LI que tratem ambas de forma eficaz - \u00e9 essencial para cumprir as suas obriga\u00e7\u00f5es de interce\u00e7\u00e3o legal nas redes de telecomunica\u00e7\u00f5es modernas.<\/p>\n\n\n\n

A recolha exacta de informa\u00e7\u00f5es relacionadas com a interce\u00e7\u00e3o \u00e9 fundamental para a legalidade das opera\u00e7\u00f5es de interce\u00e7\u00e3o. Os operadores devem garantir que os seus sistemas recolhem todos os campos de informa\u00e7\u00f5es relacionadas com a interce\u00e7\u00e3o.<\/p>\n\n\n\n

Artigos relacionados<\/h2>\n\n\n\n

Para mais informa\u00e7\u00f5es sobre temas relacionados, consulte estes artigos:<\/p>\n\n\n\n